{
  "@id": "urn:uuid:3f0169c6-647e-4d08-84c2-ac14b026494e",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 38,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-09T10:28:00.706705+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.32.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.32.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-11-03T15:08:44.196020+00:00",
      "status_notes": "Vulnerability CVE-2006-6969 does not affect version 11.0.32.tuxcare0001 of org.eclipse.jetty:jetty-server. not_affected \u2014 CVE-2006-6969 concerns predictable session identifiers due to using java.util.Random instead of cryptographically secure random number generation. The target (Jetty 11.0.32.tuxcare0001) is NOT affected because the vulnerable pattern is not present. The code uses java.security.SecureRandom by default (DefaultSessionIdManager.java line 359), with java.util.Random as a fallback only if SecureRando...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2006-6969"
      },
      "impact_statement": "not_affected \u2014 CVE-2006-6969 concerns predictable session identifiers due to using java.util.Random instead of cryptographically secure random number generation. The target (Jetty 11.0.32.tuxcare0001) is NOT affected because the vulnerable pattern is not present. The code uses java.security.SecureRandom by default (DefaultSessionIdManager.java line 359), with java.util.Random as a fallback only if SecureRando..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.32.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.32.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-11-02T16:42:00.216861+00:00",
      "status_notes": "Vulnerability CVE-2011-4461 does not affect version 11.0.32.tuxcare0001 of org.eclipse.jetty:jetty-server. not_affected \u2014 The target Jetty 11.0.32.tuxcare0001 is NOT AFFECTED by CVE-2011-4461. The vulnerability (unlimited form parameter processing leading to CPU exhaustion via hash collisions) was fixed in upstream commit 085c79d7d6cfbccc02821ffdb64968593df3e0bf from December 2011, which shipped in the upstream release that TuxCare onboarded. The fix introduces maxFormKeys (default 1000) to limit form parameter co...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2011-4461"
      },
      "impact_statement": "not_affected \u2014 The target Jetty 11.0.32.tuxcare0001 is NOT AFFECTED by CVE-2011-4461. The vulnerability (unlimited form parameter processing leading to CPU exhaustion via hash collisions) was fixed in upstream commit 085c79d7d6cfbccc02821ffdb64968593df3e0bf from December 2011, which shipped in the upstream release that TuxCare onboarded. The fix introduces maxFormKeys (default 1000) to limit form parameter co..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.32.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.32.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-11-06T17:48:00.459476+00:00",
      "status_notes": "Vulnerability CVE-2015-2080 does not affect version 11.0.32.tuxcare0001 of org.eclipse.jetty:jetty-server. Prechecker: The upstream fix is already in this version's source history (commits 3e7b5f0f, 4df5647f). Version 11.0.32 is on a newer release line than any version the advisories list as affected. Advisories: GitHub GHSA-ghgj-3xqr-6jfm (affected up to 9.2.9.v20150224), NVD (affected up to 9.3.0-m1).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2015-2080"
      },
      "impact_statement": "Prechecker: The upstream fix is already in this version's source history (commits 3e7b5f0f, 4df5647f). Version 11.0.32 is on a newer release line than any version the advisories list as affected. Advisories: GitHub GHSA-ghgj-3xqr-6jfm (affected up to 9.2.9.v20150224), NVD (affected up to 9.3.0-m1)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.32.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.32.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-11-03T15:31:44.936589+00:00",
      "status_notes": "Vulnerability CVE-2016-4800 does not affect version 11.0.32.tuxcare0001 of org.eclipse.jetty:jetty-server. not_affected \u2014 CVE-2016-4800 affects Eclipse Jetty 9.3.0-9.3.8 on Windows, allowing attackers to bypass security constraints via URLs with escaped backslashes. The vulnerability was fixed in upstream commit 97af3d663fd (May 13, 2016) which reworked PathResource alias checking to detect Windows JVM path normalization. Version 11.0.32 contains this fix as it was part of the upstream release before TuxCare onboa...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2016-4800"
      },
      "impact_statement": "not_affected \u2014 CVE-2016-4800 affects Eclipse Jetty 9.3.0-9.3.8 on Windows, allowing attackers to bypass security constraints via URLs with escaped backslashes. The vulnerability was fixed in upstream commit 97af3d663fd (May 13, 2016) which reworked PathResource alias checking to detect Windows JVM path normalization. Version 11.0.32 contains this fix as it was part of the upstream release before TuxCare onboa..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.32.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.32.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-11-03T12:44:25.010068+00:00",
      "status_notes": "Vulnerability CVE-2017-7656 does not affect version 11.0.32.tuxcare0001 of org.eclipse.jetty:jetty-server. CVE-2017-7656 affects Eclipse Jetty 9.2.x and older, 9.3.x, and 9.4.x with non-default RFC2616 compliance enabled. The target version 11.0.32 contains the upstream fix (commit a285deea42f from May 2018) that was shipped in the upstream release before TuxCare maintenance began. The fix enforces RFC7230 compliance by default, rejecting HTTP requests with multiple Content-Length headers or both Content-Length and Transfer-Encoding headers, preventing request smuggling. The vulnerable behavior only exists in non-default RFC2616_LEGACY mode.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 9.3.24.v20180605; >= 9.4.0, < 9.4.11.v20180605), NVD (<= 9.2.26; >= 9.3.0, < 9.3.24; >= 9.4.0, < 9.4.11), Snyk (< 9.3.24.v20180605; >= 9.4.0.M0, < 9.4.11.v20180605; > 8.2.0.v20160908, < 9.3.24.v20180605; >= 9.4.0.M0, < 9.4.11.v20180605).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2017-7656"
      },
      "impact_statement": "CVE-2017-7656 affects Eclipse Jetty 9.2.x and older, 9.3.x, and 9.4.x with non-default RFC2616 compliance enabled. The target version 11.0.32 contains the upstream fix (commit a285deea42f from May 2018) that was shipped in the upstream release before TuxCare maintenance began. The fix enforces RFC7230 compliance by default, rejecting HTTP requests with multiple Content-Length headers or both Content-Length and Transfer-Encoding headers, preventing request smuggling. The vulnerable behavior only exists in non-default RFC2616_LEGACY mode.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 9.3.24.v20180605; >= 9.4.0, < 9.4.11.v20180605), NVD (<= 9.2.26; >= 9.3.0, < 9.3.24; >= 9.4.0, < 9.4.11), Snyk (< 9.3.24.v20180605; >= 9.4.0.M0, < 9.4.11.v20180605; > 8.2.0.v20160908, < 9.3.24.v20180605; >= 9.4.0.M0, < 9.4.11.v20180605)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.32.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.32.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-11-09T10:28:00.706705+00:00",
      "status_notes": "Vulnerability CVE-2017-7657 does not affect version 11.0.32.tuxcare0001 of org.eclipse.jetty:jetty-server. Prechecker: the upstream fix is already in this version's git history (commits 1a4d304a, 715a637c, a285deea, d35a332b, e05c11ae). Advisories: GitHub says fixed in 9.2.25 and 9.3.24 and NVD in 9.4.11, and this version is on a newer line; the cve.org record reads as affected only because it writes each range as two half-entries. Confirmed not affected by the Java ELS team review on 2026-11-06.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2017-7657"
      },
      "impact_statement": "Prechecker: the upstream fix is already in this version's git history (commits 1a4d304a, 715a637c, a285deea, d35a332b, e05c11ae). Advisories: GitHub says fixed in 9.2.25 and 9.3.24 and NVD in 9.4.11, and this version is on a newer line; the cve.org record reads as affected only because it writes each range as two half-entries. Confirmed not affected by the Java ELS team review on 2026-11-06."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.32.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.32.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-11-03T12:22:29.685630+00:00",
      "status_notes": "Vulnerability CVE-2017-7658 does not affect version 11.0.32.tuxcare0001 of org.eclipse.jetty:jetty-server. CVE-2017-7658 is an HTTP Request Smuggling vulnerability that was fixed in upstream Eclipse Jetty by commit a285deea42f (Greg Wilkins, May 2018). The target repository version 11.0.32.tuxcare0001 contains this upstream fix, which was already present in the upstream release before TuxCare onboarded the code (first TuxCare commit 3f3b8a62465 on March 2026). The fix adds validation to reject HTTP requests with duplicate Content-Length headers or the combination of Content-Length and Transfer-Encoding: chunked headers, preventing request boundary confusion between intermediaries and Jetty. The defense is active by default via the RFC7230 compliance mode.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 9.2.25.v20180606; >= 9.3.0, < 9.3.24.v20180605; >= 9.4.0, < 9.4.11.v20180605), NVD (<= 9.2.26; >= 9.3.0, < 9.3.24; >= 9.4.0, < 9.4.11), Snyk (> 8.2.0.v20160908, < 9.2.25.v20180606; >= 9.3.0.M0, < 9.3.24.v20180605; >= 9.4.0.M0, < 9.4.11.v20180605).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2017-7658"
      },
      "impact_statement": "CVE-2017-7658 is an HTTP Request Smuggling vulnerability that was fixed in upstream Eclipse Jetty by commit a285deea42f (Greg Wilkins, May 2018). The target repository version 11.0.32.tuxcare0001 contains this upstream fix, which was already present in the upstream release before TuxCare onboarded the code (first TuxCare commit 3f3b8a62465 on March 2026). The fix adds validation to reject HTTP requests with duplicate Content-Length headers or the combination of Content-Length and Transfer-Encoding: chunked headers, preventing request boundary confusion between intermediaries and Jetty. The defense is active by default via the RFC7230 compliance mode.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 9.2.25.v20180606; >= 9.3.0, < 9.3.24.v20180605; >= 9.4.0, < 9.4.11.v20180605), NVD (<= 9.2.26; >= 9.3.0, < 9.3.24; >= 9.4.0, < 9.4.11), Snyk (> 8.2.0.v20160908, < 9.2.25.v20180606; >= 9.3.0.M0, < 9.3.24.v20180605; >= 9.4.0.M0, < 9.4.11.v20180605)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.32.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.32.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-11-03T12:34:10.404462+00:00",
      "status_notes": "Vulnerability CVE-2017-9735 does not affect version 11.0.32.tuxcare0001 of org.eclipse.jetty:jetty-server. CVE-2017-9735 describes a timing channel attack vulnerability in Jetty's password comparison logic. The target repository (Jetty 11.0.32) is NOT AFFECTED because the complete fix was already present in the upstream release before TuxCare onboarding. The vulnerable pattern (variable-time string comparison that leaks timing information) has been replaced with constant-time comparison methods in Credential.java that always execute for the full length of the attacker-provided credential, using bitwise AND operations to prevent short-circuit evaluation. The fix was authored by upstream Jetty developers (Greg Wilkins, Simone Bordet, Lachlan Roberts) across commits 042f325f1cd through e727ad893d2, all of which predate the first TuxCare commit (3af31a13e51) on this branch.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.4.0, < 9.4.6.v20170531; >= 9.3.0, < 9.3.20.v20170531; < 9.2.22.v20170606), NVD (< 9.2.22; >= 9.3.0, < 9.3.20; >= 9.4.0, < 9.4.6), Snyk (< 9.2.22.v20170606; >= 9.3.0.M0, < 9.3.20.v20170531; >= 9.4.0.M0, < 9.4.6.v20170531).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2017-9735"
      },
      "impact_statement": "CVE-2017-9735 describes a timing channel attack vulnerability in Jetty's password comparison logic. The target repository (Jetty 11.0.32) is NOT AFFECTED because the complete fix was already present in the upstream release before TuxCare onboarding. The vulnerable pattern (variable-time string comparison that leaks timing information) has been replaced with constant-time comparison methods in Credential.java that always execute for the full length of the attacker-provided credential, using bitwise AND operations to prevent short-circuit evaluation. The fix was authored by upstream Jetty developers (Greg Wilkins, Simone Bordet, Lachlan Roberts) across commits 042f325f1cd through e727ad893d2, all of which predate the first TuxCare commit (3af31a13e51) on this branch.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.4.0, < 9.4.6.v20170531; >= 9.3.0, < 9.3.20.v20170531; < 9.2.22.v20170606), NVD (< 9.2.22; >= 9.3.0, < 9.3.20; >= 9.4.0, < 9.4.6), Snyk (< 9.2.22.v20170606; >= 9.3.0.M0, < 9.3.20.v20170531; >= 9.4.0.M0, < 9.4.6.v20170531)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.32.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.32.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-10-31T18:17:03.969398+00:00",
      "status_notes": "Vulnerability CVE-2018-12536 does not affect version 11.0.32.tuxcare0001 of org.eclipse.jetty:jetty-server. not_affected \u2014 Target version 11.0.32.tuxcare0001 is NOT AFFECTED by CVE-2018-12536. The vulnerability pattern (unprotected path resolution allowing server filesystem path disclosure via InvalidPathException) is not present in the target. The upstream fix by Joakim Erdfelt (Issue #2560, commits ad4dceb1c08/65de2c66901/53e8bc2a636) shipped in the upstream Jetty 11.0.26 release before TuxCare onboarded this ver...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-12536"
      },
      "impact_statement": "not_affected \u2014 Target version 11.0.32.tuxcare0001 is NOT AFFECTED by CVE-2018-12536. The vulnerability pattern (unprotected path resolution allowing server filesystem path disclosure via InvalidPathException) is not present in the target. The upstream fix by Joakim Erdfelt (Issue #2560, commits ad4dceb1c08/65de2c66901/53e8bc2a636) shipped in the upstream Jetty 11.0.26 release before TuxCare onboarded this ver..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.32.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.32.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-10-28T23:59:58.436178+00:00",
      "status_notes": "Vulnerability CVE-2018-12538 affects version 11.0.32.tuxcare0001 of org.eclipse.jetty:jetty-server.",
      "vulnerability": {
        "name": "CVE-2018-12538"
      },
      "action_statement": "Vulnerability CVE-2018-12538 affects version 11.0.32.tuxcare0001 of org.eclipse.jetty:jetty-server."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.32.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.32.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-11-04T09:14:29.621948+00:00",
      "status_notes": "Vulnerability CVE-2018-12545 does not affect version 11.0.32.tuxcare0001 of org.eclipse.jetty:jetty-server. CVE-2018-12545 targets Jetty 9.3.x/9.4.x HTTP/2 DoS via excessive SETTINGS frames. The target (Jetty 11.0.32) contains the upstream fix that limits settings keys to 64 per frame and adds rate control. The fix was shipped in the upstream release before TuxCare's work began (commit 9eca404da29, authored by simone.bordet@gmail.com, is an ancestor of the first TuxCare commit 3af31a13e51). The defense is active by default in SettingsBodyParser.onSetting() which rejects frames exceeding DEFAULT_MAX_KEYS with ENHANCE_YOUR_CALM_ERROR. Verdict: not_affected (upstream-authored fix already present).\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.4.0, < 9.4.12.v20180830; >= 9.3.0, < 9.3.25.v20180904), NVD (= 9.3.0-20150601; = 9.3.0-20150608; = 9.3.0-20150612; = 9.3.0-maintenance0; = 9.3.0-maintenance1; = 9.3.0-maintenance2; = 9.3.0-rc0; = 9.3.0-rc1; = 9.3.1-20150714; = 9.3.2-20150730; = 9.3.3-20150825; = 9.3.3-20150827; = 9.3.4-20151005; = 9.3.4-20151007; = 9.3.4-rc0; = 9.3.4-rc1; = 9.3.5-20151012; = 9.3.6-20151106; = 9.3.7-20160115; = 9.3.7-rc0; = 9.3.7-rc1; = 9.3.8-20160311; = 9.3.8-20160314; = 9.3.8-rc0; = 9.3.9-20160517; = 9.3.9-maintenance_0; = 9.3.9-maintenance_1; = 9.3.10-20160621; = 9.3.10-maintenance_0; = 9.3.11-20160721; = 9.3.11-maintenance_0; = 9.3.12-20160915; = 9.3.13-20161014; = 9.3.13-maintenance_0; = 9.3.14-20161028; = 9.3.15-20161220; = 9.3.16-20170119; = 9.3.16-20170120; = 9.3.17-20170317; = 9.3.17-rc0; = 9.3.18-20170406; = 9.3.19-20170502; = 9.3.20-20170531; = 9.3.21-20170918; = 9.3.21-maintenance_0; = 9.3.21-rc0; = 9.3.22-20171030; = 9.3.23-20180228; = 9.3.24-20180605; = 9.4.0-20161207; = 9.4.0-20161208; = 9.4.0-20180619; = 9.4.0-maintenance_0; = 9.4.0-maintenance_1; = 9.4.0-rc0; = 9.4.0-rc1; = 9.4.0-rc2; = 9.4.0-rc3; = 9.4.1-20170120; = 9.4.1-20180619; = 9.4.2-20170220; = 9.4.2-20180619; = 9.4.3-20170317; = 9.4.3-20180619; = 9.4.4-20170410; = 9.4.4-20170414; = 9.4.4-20180619; = 9.4.5-20170502; = 9.4.5-20180619; = 9.4.6-20170531; = 9.4.6-20180619; = 9.4.7-20170914; = 9.4.7-20180619; = 9.4.7-rc0; = 9.4.8-20171121; = 9.4.8-20180619; = 9.4.9-20180320; = 9.4.10-20180503; = 9.4.10-rc0; = 9.4.10-rc1; = 9.4.11-20180605; = 9.4.12-rc0; = 9.4.12-rc1; = 9.4.12-rc2), Snyk (<= 0; >= 9.3.0.M0, < 9.4.12.v20180830).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-12545"
      },
      "impact_statement": "CVE-2018-12545 targets Jetty 9.3.x/9.4.x HTTP/2 DoS via excessive SETTINGS frames. The target (Jetty 11.0.32) contains the upstream fix that limits settings keys to 64 per frame and adds rate control. The fix was shipped in the upstream release before TuxCare's work began (commit 9eca404da29, authored by simone.bordet@gmail.com, is an ancestor of the first TuxCare commit 3af31a13e51). The defense is active by default in SettingsBodyParser.onSetting() which rejects frames exceeding DEFAULT_MAX_KEYS with ENHANCE_YOUR_CALM_ERROR. Verdict: not_affected (upstream-authored fix already present).\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.4.0, < 9.4.12.v20180830; >= 9.3.0, < 9.3.25.v20180904), NVD (= 9.3.0-20150601; = 9.3.0-20150608; = 9.3.0-20150612; = 9.3.0-maintenance0; = 9.3.0-maintenance1; = 9.3.0-maintenance2; = 9.3.0-rc0; = 9.3.0-rc1; = 9.3.1-20150714; = 9.3.2-20150730; = 9.3.3-20150825; = 9.3.3-20150827; = 9.3.4-20151005; = 9.3.4-20151007; = 9.3.4-rc0; = 9.3.4-rc1; = 9.3.5-20151012; = 9.3.6-20151106; = 9.3.7-20160115; = 9.3.7-rc0; = 9.3.7-rc1; = 9.3.8-20160311; = 9.3.8-20160314; = 9.3.8-rc0; = 9.3.9-20160517; = 9.3.9-maintenance_0; = 9.3.9-maintenance_1; = 9.3.10-20160621; = 9.3.10-maintenance_0; = 9.3.11-20160721; = 9.3.11-maintenance_0; = 9.3.12-20160915; = 9.3.13-20161014; = 9.3.13-maintenance_0; = 9.3.14-20161028; = 9.3.15-20161220; = 9.3.16-20170119; = 9.3.16-20170120; = 9.3.17-20170317; = 9.3.17-rc0; = 9.3.18-20170406; = 9.3.19-20170502; = 9.3.20-20170531; = 9.3.21-20170918; = 9.3.21-maintenance_0; = 9.3.21-rc0; = 9.3.22-20171030; = 9.3.23-20180228; = 9.3.24-20180605; = 9.4.0-20161207; = 9.4.0-20161208; = 9.4.0-20180619; = 9.4.0-maintenance_0; = 9.4.0-maintenance_1; = 9.4.0-rc0; = 9.4.0-rc1; = 9.4.0-rc2; = 9.4.0-rc3; = 9.4.1-20170120; = 9.4.1-20180619; = 9.4.2-20170220; = 9.4.2-20180619; = 9.4.3-20170317; = 9.4.3-20180619; = 9.4.4-20170410; = 9.4.4-20170414; = 9.4.4-20180619; = 9.4.5-20170502; = 9.4.5-20180619; = 9.4.6-20170531; = 9.4.6-20180619; = 9.4.7-20170914; = 9.4.7-20180619; = 9.4.7-rc0; = 9.4.8-20171121; = 9.4.8-20180619; = 9.4.9-20180320; = 9.4.10-20180503; = 9.4.10-rc0; = 9.4.10-rc1; = 9.4.11-20180605; = 9.4.12-rc0; = 9.4.12-rc1; = 9.4.12-rc2), Snyk (<= 0; >= 9.3.0.M0, < 9.4.12.v20180830)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.32.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.32.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-10-31T16:17:57.385112+00:00",
      "status_notes": "Vulnerability CVE-2019-10241 does not affect version 11.0.32.tuxcare0001 of org.eclipse.jetty:jetty-server. not_affected \u2014 The target Jetty version 11.0.32 is not affected by CVE-2019-10241 (XSS in directory listings). The vulnerability affected versions 9.2.26 and older, 9.3.25 and older, and 9.4.15 and older. The fix was introduced by upstream commit 7b774d82e82 authored by Joakim Erdfelt and was already present in the upstream release when TuxCare onboarded version 11.0.26. The fix includes proper URL decoding v...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-10241"
      },
      "impact_statement": "not_affected \u2014 The target Jetty version 11.0.32 is not affected by CVE-2019-10241 (XSS in directory listings). The vulnerability affected versions 9.2.26 and older, 9.3.25 and older, and 9.4.15 and older. The fix was introduced by upstream commit 7b774d82e82 authored by Joakim Erdfelt and was already present in the upstream release when TuxCare onboarded version 11.0.26. The fix includes proper URL decoding v..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.32.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.32.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-11-02T16:42:00.216861+00:00",
      "status_notes": "Vulnerability CVE-2019-10246 does not affect version 11.0.32.tuxcare0001 of org.eclipse.jetty:jetty-server. not_affected \u2014 The target repository (Jetty 11.0.32) is not affected by CVE-2019-10246. The vulnerability involved directory listings on Windows servers exposing fully qualified filesystem paths instead of just filenames. The fix (commit 7b774d82e82) was authored by upstream Jetty developer Joakim Erdfelt and was already present in the upstream release before TuxCare's onboarding (first TuxCare commit 3af31a1...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-10246"
      },
      "impact_statement": "not_affected \u2014 The target repository (Jetty 11.0.32) is not affected by CVE-2019-10246. The vulnerability involved directory listings on Windows servers exposing fully qualified filesystem paths instead of just filenames. The fix (commit 7b774d82e82) was authored by upstream Jetty developer Joakim Erdfelt and was already present in the upstream release before TuxCare's onboarding (first TuxCare commit 3af31a1..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.32.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.32.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-10-31T16:39:00.118825+00:00",
      "status_notes": "Vulnerability CVE-2019-10247 does not affect version 11.0.32.tuxcare0001 of org.eclipse.jetty:jetty-server. not_affected \u2014 CVE-2019-10247 is an information disclosure vulnerability in Jetty's DefaultHandler that reveals the fully qualified directory base resource location in 404 error pages via context.toString() output. The target repository (Jetty 11.0.32) is not affected because the upstream fix (commit 04c994712c0 by joakim.erdfelt@gmail.com from April 2019, Issue #3555) was already present in the upstream rele...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-10247"
      },
      "impact_statement": "not_affected \u2014 CVE-2019-10247 is an information disclosure vulnerability in Jetty's DefaultHandler that reveals the fully qualified directory base resource location in 404 error pages via context.toString() output. The target repository (Jetty 11.0.32) is not affected because the upstream fix (commit 04c994712c0 by joakim.erdfelt@gmail.com from April 2019, Issue #3555) was already present in the upstream rele..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.32.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.32.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-11-02T19:18:00.143361+00:00",
      "status_notes": "Vulnerability CVE-2019-17632 does not affect version 11.0.32.tuxcare0001 of org.eclipse.jetty:jetty-server. not_affected \u2014 CVE-2019-17632 is not present in Jetty 11.0.32. The vulnerability involved unescaped exception messages in error responses allowing XSS attacks. The upstream fix (commit cf0df6e3ffd by Joakim Erdfelt) was already present in the Jetty release that TuxCare onboarded. All exception messages and stack traces are now sanitized via StringUtil.sanitizeXmlString() before being written to error response...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-17632"
      },
      "impact_statement": "not_affected \u2014 CVE-2019-17632 is not present in Jetty 11.0.32. The vulnerability involved unescaped exception messages in error responses allowing XSS attacks. The upstream fix (commit cf0df6e3ffd by Joakim Erdfelt) was already present in the Jetty release that TuxCare onboarded. All exception messages and stack traces are now sanitized via StringUtil.sanitizeXmlString() before being written to error response..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.32.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.32.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-11-04T09:15:51.446651+00:00",
      "status_notes": "Vulnerability CVE-2019-17638 does not affect version 11.0.32.tuxcare0001 of org.eclipse.jetty:jetty-server. CVE-2019-17638 (ByteBuffer double-release causing cross-client data leakage) is NOT present in target Jetty 11.0.32. The upstream fix (commit ff8ae56fa93) was already included in the upstream release that TuxCare onboarded (11.0.26). The fix predates the first TuxCare commit (3af31a13e51 \"setup 11.0.26\"), confirming it shipped in the upstream release. Code inspection confirms the fix is present: releaseHeader() and releaseChunk() methods properly null buffers after release, HEADER_OVERFLOW checks size before releasing, and _header/_chunk fields are scoped to SendCallback inner class (not class-level). The vulnerable double-release pattern is absent.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.4.27, < 9.4.30.v20200611), NVD (= 9.4.27-20200227; = 9.4.28-20200408; = 9.4.29-20200521), Snyk (>= 9.4.27.v20200227, < 9.4.30.v20200611).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-17638"
      },
      "impact_statement": "CVE-2019-17638 (ByteBuffer double-release causing cross-client data leakage) is NOT present in target Jetty 11.0.32. The upstream fix (commit ff8ae56fa93) was already included in the upstream release that TuxCare onboarded (11.0.26). The fix predates the first TuxCare commit (3af31a13e51 \"setup 11.0.26\"), confirming it shipped in the upstream release. Code inspection confirms the fix is present: releaseHeader() and releaseChunk() methods properly null buffers after release, HEADER_OVERFLOW checks size before releasing, and _header/_chunk fields are scoped to SendCallback inner class (not class-level). The vulnerable double-release pattern is absent.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.4.27, < 9.4.30.v20200611), NVD (= 9.4.27-20200227; = 9.4.28-20200408; = 9.4.29-20200521), Snyk (>= 9.4.27.v20200227, < 9.4.30.v20200611)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.32.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.32.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-11-02T19:36:34.527535+00:00",
      "status_notes": "Vulnerability CVE-2020-27218 does not affect version 11.0.32.tuxcare0001 of org.eclipse.jetty:jetty-server. not_affected \u2014 CVE-2020-27218 (Jetty GZIP request body inflation vulnerability) is not present in target version 11.0.32. The fix for Issue #5605 was already included in upstream Jetty 11.0.26, which TuxCare subsequently onboarded. The target inherits comprehensive defenses: GzipHttpInputInterceptor.failed() releases decoder resources properly; HttpChannel.ensureConsumeAllOrNotPersistent() ensures unconsumed ...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-27218"
      },
      "impact_statement": "not_affected \u2014 CVE-2020-27218 (Jetty GZIP request body inflation vulnerability) is not present in target version 11.0.32. The fix for Issue #5605 was already included in upstream Jetty 11.0.26, which TuxCare subsequently onboarded. The target inherits comprehensive defenses: GzipHttpInputInterceptor.failed() releases decoder resources properly; HttpChannel.ensureConsumeAllOrNotPersistent() ensures unconsumed ..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.32.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.32.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-11-02T19:30:41.513971+00:00",
      "status_notes": "Vulnerability CVE-2020-27223 does not affect version 11.0.32.tuxcare0001 of org.eclipse.jetty:jetty-server. not_affected \u2014 The target repository (Jetty 11.0.32.tuxcare0001) is NOT affected by CVE-2020-27223. The vulnerability was fixed in upstream Jetty 11.0.1 (released February 2021), and the target version contains the fix that shipped in the upstream release. The vulnerable O(n\u00b2) bubble-sort algorithm with loop reset in QuotedQualityCSV has been replaced with an efficient O(n log n) stream-based sort using Java'...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-27223"
      },
      "impact_statement": "not_affected \u2014 The target repository (Jetty 11.0.32.tuxcare0001) is NOT affected by CVE-2020-27223. The vulnerability was fixed in upstream Jetty 11.0.1 (released February 2021), and the target version contains the fix that shipped in the upstream release. The vulnerable O(n\u00b2) bubble-sort algorithm with loop reset in QuotedQualityCSV has been replaced with an efficient O(n log n) stream-based sort using Java'..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.32.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.32.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-11-03T12:30:34.591989+00:00",
      "status_notes": "Vulnerability CVE-2021-28165 does not affect version 11.0.32.tuxcare0001 of org.eclipse.jetty:jetty-server. CVE-2021-28165 is NOT present in the target repository. The vulnerability, which allowed invalid large TLS frames (>17408 bytes) to cause infinite CPU consumption, was fixed in upstream commit 039c7386d0f by Simone Bordet. This fix was already included in the upstream Jetty release that TuxCare onboarded (version 11.0.26), well before the target version 11.0.32.tuxcare0001. The fix adds a buffer space check in the BUFFER_UNDERFLOW case that immediately throws an SSLHandshakeException when the encrypted input buffer is full, preventing the infinite loop. The vulnerable code pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 7.2.2, < 9.4.39; >= 10.0.0, < 10.0.2; >= 11.0.0, < 11.0.2), NVD (>= 7.2.2, < 9.4.39; >= 10.0.0, < 10.0.2; >= 11.0.0, < 11.0.2), Snyk (>= 7.2.2.v20101205, < 9.4.39.v20210325; >= 10.0.0.alpha0, < 10.0.2; >= 11.0.0.alpha0, < 11.0.2).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2021-28165"
      },
      "impact_statement": "CVE-2021-28165 is NOT present in the target repository. The vulnerability, which allowed invalid large TLS frames (>17408 bytes) to cause infinite CPU consumption, was fixed in upstream commit 039c7386d0f by Simone Bordet. This fix was already included in the upstream Jetty release that TuxCare onboarded (version 11.0.26), well before the target version 11.0.32.tuxcare0001. The fix adds a buffer space check in the BUFFER_UNDERFLOW case that immediately throws an SSLHandshakeException when the encrypted input buffer is full, preventing the infinite loop. The vulnerable code pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 7.2.2, < 9.4.39; >= 10.0.0, < 10.0.2; >= 11.0.0, < 11.0.2), NVD (>= 7.2.2, < 9.4.39; >= 10.0.0, < 10.0.2; >= 11.0.0, < 11.0.2), Snyk (>= 7.2.2.v20101205, < 9.4.39.v20210325; >= 10.0.0.alpha0, < 10.0.2; >= 11.0.0.alpha0, < 11.0.2)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.32.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.32.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-10-31T15:25:18.094032+00:00",
      "status_notes": "Vulnerability CVE-2021-34428 does not affect version 11.0.32.tuxcare0001 of org.eclipse.jetty:jetty-server. not_affected \u2014 The target repository (Jetty 11.0.32.tuxcare0001) is not affected by CVE-2021-34428. The vulnerability was fixed in upstream Jetty commit 087f486b446 (May 2021) which added exception handling around SessionListener#sessionDestroyed() and moved the invalidateAll() call into a finally block. This fix was already present in upstream Jetty 11.0.26, which is the base version TuxCare onboarded from (...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2021-34428"
      },
      "impact_statement": "not_affected \u2014 The target repository (Jetty 11.0.32.tuxcare0001) is not affected by CVE-2021-34428. The vulnerability was fixed in upstream Jetty commit 087f486b446 (May 2021) which added exception handling around SessionListener#sessionDestroyed() and moved the invalidateAll() call into a finally block. This fix was already present in upstream Jetty 11.0.26, which is the base version TuxCare onboarded from (..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.32.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.32.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-11-04T09:14:29.621948+00:00",
      "status_notes": "Vulnerability CVE-2022-2191 does not affect version 11.0.32.tuxcare0001 of org.eclipse.jetty:jetty-server. CVE-2022-2191 is not present in jetty.project 11.0.32.tuxcare0001. The vulnerability (ByteBuffer resource leaks in SslConnection error paths during TLS handshake failures) was fixed by upstream commit 66de7ba6180 (\"Improve ssl buffers handling #8165\") authored by Ludovic Orban. This fix shipped in the upstream release that TuxCare onboarded, before any TuxCare maintenance began. The target code contains all defensive methods (discardInputBuffers(), discardEncryptedOutputBuffer()) and correctly invokes them in exception handlers at lines 821, 1190, 1382, 1431, and 1615 of SslConnection.java.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 10.0.0, < 10.0.10; >= 11.0.0, < 11.0.10), NVD (>= 10.0.0, <= 10.0.9; >= 11.0.0, <= 11.0.9), Snyk (>= 10.0.0, < 10.0.10; >= 11.0.0, < 11.0.10; >= 10.0.0, < 10.0.10; >= 11.0.0, < 11.0.10).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2022-2191"
      },
      "impact_statement": "CVE-2022-2191 is not present in jetty.project 11.0.32.tuxcare0001. The vulnerability (ByteBuffer resource leaks in SslConnection error paths during TLS handshake failures) was fixed by upstream commit 66de7ba6180 (\"Improve ssl buffers handling #8165\") authored by Ludovic Orban. This fix shipped in the upstream release that TuxCare onboarded, before any TuxCare maintenance began. The target code contains all defensive methods (discardInputBuffers(), discardEncryptedOutputBuffer()) and correctly invokes them in exception handlers at lines 821, 1190, 1382, 1431, and 1615 of SslConnection.java.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 10.0.0, < 10.0.10; >= 11.0.0, < 11.0.10), NVD (>= 10.0.0, <= 10.0.9; >= 11.0.0, <= 11.0.9), Snyk (>= 10.0.0, < 10.0.10; >= 11.0.0, < 11.0.10; >= 10.0.0, < 10.0.10; >= 11.0.0, < 11.0.10)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.32.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.32.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-10-31T15:48:00.193781+00:00",
      "status_notes": "Vulnerability CVE-2023-26048 does not affect version 11.0.32.tuxcare0001 of org.eclipse.jetty:jetty-server. not_affected \u2014 Target Jetty 11.0.32 is not affected by CVE-2023-26048. Both required defenses are present and active by default: (1) max parts limit via _maxParts field (default 1000 parts), and (2) cumulative size check for parts without filenames via formContentSize accumulator (default 200KB limit). The fix was introduced by upstream Eclipse Jetty commit 1042cdb8a54 (author: lachlan@webtide.com, Feb 13 202...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2023-26048"
      },
      "impact_statement": "not_affected \u2014 Target Jetty 11.0.32 is not affected by CVE-2023-26048. Both required defenses are present and active by default: (1) max parts limit via _maxParts field (default 1000 parts), and (2) cumulative size check for parts without filenames via formContentSize accumulator (default 200KB limit). The fix was introduced by upstream Eclipse Jetty commit 1042cdb8a54 (author: lachlan@webtide.com, Feb 13 202..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.32.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.32.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-10-31T15:16:00.096279+00:00",
      "status_notes": "Vulnerability CVE-2023-26049 does not affect version 11.0.32.tuxcare0001 of org.eclipse.jetty:jetty-server. not_affected \u2014 CVE-2023-26049 is NOT present in target version 11.0.32. The vulnerability involved cookie smuggling via nonstandard parsing of quoted cookie values containing semicolons. The upstream fix (commit 7b8c2c1bf08) was released in Jetty 11.0.14 and was already present when TuxCare onboarded version 11.0.26. The current code correctly rejects semicolons uniformly, preventing the cookie smuggling attack.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2023-26049"
      },
      "impact_statement": "not_affected \u2014 CVE-2023-26049 is NOT present in target version 11.0.32. The vulnerability involved cookie smuggling via nonstandard parsing of quoted cookie values containing semicolons. The upstream fix (commit 7b8c2c1bf08) was released in Jetty 11.0.14 and was already present when TuxCare onboarded version 11.0.26. The current code correctly rejects semicolons uniformly, preventing the cookie smuggling attack."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.32.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.32.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-11-04T09:12:34.459172+00:00",
      "status_notes": "Vulnerability CVE-2024-13009 does not affect version 11.0.32.tuxcare0001 of org.eclipse.jetty:jetty-server. Jetty 11.0.32 is not affected by CVE-2024-13009. The vulnerability involves improper buffer lifecycle management when gzip decompression fails, leading to potential data corruption or cross-request data leakage. The upstream Jetty 11.x architecture was refactored to use a ContentProducer pattern that includes proper buffer nulling on errors. The fix (commit 25467f89043 by Ludovic Orban, April 2021) predates both the CVE assignment (2024) and TuxCare's setup of this repository (Dec 2025). The vulnerable code pattern present in Jetty 9.4.x does not exist in the 11.x codebase.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.4.0, < 9.4.57.v20241219), NVD (>= 9.4.0, < 9.4.57), cve.org (>= 9.4.0, <= 9.4.56), Snyk (>= 9.4.0.M0, < 9.4.57.v20241219).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2024-13009"
      },
      "impact_statement": "Jetty 11.0.32 is not affected by CVE-2024-13009. The vulnerability involves improper buffer lifecycle management when gzip decompression fails, leading to potential data corruption or cross-request data leakage. The upstream Jetty 11.x architecture was refactored to use a ContentProducer pattern that includes proper buffer nulling on errors. The fix (commit 25467f89043 by Ludovic Orban, April 2021) predates both the CVE assignment (2024) and TuxCare's setup of this repository (Dec 2025). The vulnerable code pattern present in Jetty 9.4.x does not exist in the 11.x codebase.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.4.0, < 9.4.57.v20241219), NVD (>= 9.4.0, < 9.4.57), cve.org (>= 9.4.0, <= 9.4.56), Snyk (>= 9.4.0.M0, < 9.4.57.v20241219)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.32.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.32.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-11-04T09:14:29.621948+00:00",
      "status_notes": "Vulnerability CVE-2024-7708 does not affect version 11.0.32.tuxcare0001 of org.eclipse.jetty:jetty-server. CVE-2024-7708 affects Jetty 11.0.0-11.0.22 (memory leak in 100-Continue/slow network request handling). The target version 11.0.32.tuxcare0001 is NOT AFFECTED because the upstream vendor (Eclipse Jetty) already fixed this vulnerability in version 11.0.23, and the fix is present in the target's codebase. The fix commit 8259eabbc70 by Simone Bordet (simone.bordet@gmail.com) added buffer release logic when fillRequestBuffer() returns \u22640 bytes, preventing buffer accumulation. This fix shipped in the upstream release that TuxCare onboarded as version 11.0.26, before any TuxCare maintenance work began on this branch.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 10.0.7, < 10.0.23; >= 11.0.7, < 11.0.23), NVD (>= 10.0.7, < 10.0.23; >= 11.0.7, < 11.0.23), cve.org (>= 10.0.7, < 10.0.23; >= 11.0.7, < 11.0.23), Snyk (>= 10.0.7, < 10.0.23; >= 11.0.7, < 11.0.23).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2024-7708"
      },
      "impact_statement": "CVE-2024-7708 affects Jetty 11.0.0-11.0.22 (memory leak in 100-Continue/slow network request handling). The target version 11.0.32.tuxcare0001 is NOT AFFECTED because the upstream vendor (Eclipse Jetty) already fixed this vulnerability in version 11.0.23, and the fix is present in the target's codebase. The fix commit 8259eabbc70 by Simone Bordet (simone.bordet@gmail.com) added buffer release logic when fillRequestBuffer() returns \u22640 bytes, preventing buffer accumulation. This fix shipped in the upstream release that TuxCare onboarded as version 11.0.26, before any TuxCare maintenance work began on this branch.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 10.0.7, < 10.0.23; >= 11.0.7, < 11.0.23), NVD (>= 10.0.7, < 10.0.23; >= 11.0.7, < 11.0.23), cve.org (>= 10.0.7, < 10.0.23; >= 11.0.7, < 11.0.23), Snyk (>= 10.0.7, < 10.0.23; >= 11.0.7, < 11.0.23)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.32.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.32.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2024-8184 does not affect version 11.0.32.tuxcare0001 of org.eclipse.jetty:jetty-server. Version 11.0.28 is not vulnerable. Summary: The target repository already has the security fix for CVE-2024-8184 applied. The code uses atomic compute() operations with reference counting and proper cleanup mechanisms to prevent memory exhaustion. [terminalized not_affected from patch_application_manual/not_vulnerable]",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2024-8184"
      },
      "impact_statement": "Version 11.0.28 is not vulnerable. Summary: The target repository already has the security fix for CVE-2024-8184 applied. The code uses atomic compute() operations with reference counting and proper cleanup mechanisms to prevent memory exhaustion. [terminalized not_affected from patch_application_manual/not_vulnerable]"
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.32.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.32.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-10051 does not affect version 11.0.32.tuxcare0001 of org.eclipse.jetty:jetty-server. Jetty 11.0.30 is outside the affected range (12.0.0\u201312.0.35 and 12.1.0\u201312.1.9). CVE-2026-10051 affects the Jetty 12 lifecycle where connection-scoped trailer state can survive parser reuse. This code path is absent in Jetty 11.0.30, where the HTTP channel clears its trailer state during request recycle before the parser is reused. Therefore, trailer state cannot leak between requests in this version.",
      "vulnerability": {
        "name": "CVE-2026-10051"
      },
      "impact_statement": "Jetty 11.0.30 is outside the affected range (12.0.0\u201312.0.35 and 12.1.0\u201312.1.9). CVE-2026-10051 affects the Jetty 12 lifecycle where connection-scoped trailer state can survive parser reuse. This code path is absent in Jetty 11.0.30, where the HTTP channel clears its trailer state during request recycle before the parser is reused. Therefore, trailer state cannot leak between requests in this version."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.32.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.32.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-12611 is fixed in version 11.0.32.tuxcare0001 of org.eclipse.jetty:jetty-server.",
      "vulnerability": {
        "name": "CVE-2026-12611"
      }
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.32.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.32.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-1605 does not affect version 11.0.32.tuxcare0001 of org.eclipse.jetty:jetty-server. Version 11.0.28 is not vulnerable. Summary: Target repository is NOT vulnerable to CVE-2026-1605. The vulnerability affects Jetty 12.x (versions 12.0.0-12.0.31 and 12.1.0-12.0.5), while the target is running Jetty 11.0.28.tuxcare0001, which uses a different architecture for request decompression that does not exhibit this vulnerability. [terminalized not_affected from patch_application_manual/not_vulnerable]",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-1605"
      },
      "impact_statement": "Version 11.0.28 is not vulnerable. Summary: Target repository is NOT vulnerable to CVE-2026-1605. The vulnerability affects Jetty 12.x (versions 12.0.0-12.0.31 and 12.1.0-12.0.5), while the target is running Jetty 11.0.28.tuxcare0001, which uses a different architecture for request decompression that does not exhibit this vulnerability. [terminalized not_affected from patch_application_manual/not_vulnerable]"
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.32.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.32.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-19203 is fixed in version 11.0.32.tuxcare0001 of org.eclipse.jetty:jetty-server.",
      "vulnerability": {
        "name": "CVE-2026-19203"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.32.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.32.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-19204 is fixed in version 11.0.32.tuxcare0001 of org.eclipse.jetty:jetty-server.",
      "vulnerability": {
        "name": "CVE-2026-19204"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.32.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.32.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-6790 is fixed in version 11.0.32.tuxcare0001 of org.eclipse.jetty:jetty-server.",
      "vulnerability": {
        "name": "CVE-2026-6790"
      }
    }
  ]
}